There are HTTP and HTTPS page on our site on Apache. So We need to convert from HTTPS to HTTP or from HTTP to HTTPS to prevent from login session cookie fired.

I already know that it does not make sense to make secure = false on SSL but want to know that it is possible to do that or any way to do this on Apache's configuration change.

Any feedback will be appreciated.

Thank you

  • You're trying to solve the wrong problem. Just redirect all your HTTP traffic to HTTPS. Then you don't need insecure cookies. – Quentin May 19 '16 at 9:30
  • Thanks Quentin. I already know that we cannot say it's not secured if disabled secure attribute on HTTPS. But I found how to set cookie without secure attribute on Apache httpd.conf as follows. <IfModule mod_headers.c> Header edit Set-Cookie ^(.*)$ $1;HttpOnly </IfModule> – Tony Cho May 23 '16 at 1:01
  • Yes, it is possible to make you visitor's cookies more likely to be stolen, it just isn't a good idea! – Quentin May 23 '16 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.